Three vishing case files from one month at a retail help desk: every call sounded fine, and every flag came from the signals underneath it, not the voice on it.
Four DPRK IT workers detected in a single hiring cohort of 600. Network, device, and identity signals. Zero credentials issued.